PkgSafe checks open-source packages before they install. It returns a clear allow, warn, or block decision from your terminal, CI, or AI coding agent.
Public beta scope today: npm and PyPI. Preview: Go modules and Cargo (metadata + OSV; not full artifact depth).
| Doc | When to use it |
|---|---|
| Getting started | First install, first scan, first policy |
| Install | Binary install, Homebrew-style paths, Windows |
| Release verification | Checksums, cosign, attestations, SBOM |
| GA / production checklist | Path to PRODUCTION_GA_READY |
| Commands | Full command list and common flags |
| Troubleshooting | Doctor failures, offline mode, false blocks |
| Doc | Topic |
|---|---|
| Policy guide | Modes, scores, trusted/blocked lists, exceptions |
| Known limitations | What GA does not claim |
| Behavior analysis | Optional script execution (heuristic / isolated) |
| Offline intelligence bundles | Air-gapped advisory data |
| Private registry | Private npm/PyPI routing |
| Doc | Topic |
|---|---|
| GitHub Action | PR gates, SARIF, summary comments |
| CI/CD | pkgsafe ci scan on any runner |
| Install interception | Safe wrappers around npm / pnpm / yarn / pip / uv |
| Doc | Topic |
|---|---|
| Claude Code | MCP setup for Claude Code |
| Codex | OpenAI Codex |
| Gemini CLI | Gemini CLI |
| GitHub Copilot agent | Copilot agent |
| Slash commands | Agent skill packs |
| Generic MCP client | Any MCP host |
| Cursor (legacy path) | Cursor-specific notes |
Also see root README section Guard your AI agent (MCP).
| Doc | Topic |
|---|---|
| Feedback | How to report false positives/negatives safely |
| GitHub Discussions | Questions and community |
Never paste secrets, tokens, private source, or registry credentials into public issues.
These support maintainers and product planning. Prefer the tables above if you are installing or running PkgSafe.
| Doc | Topic |
|---|---|
| Architecture (current) | How the binary is structured |
| Open-core boundary | OSS vs enterprise |
| Threat model | High-level threats |
| PRD | Product requirements (historical + planning) |
| Roadmap | Direction |
| App structure | Repo layout |
| Launch kit | Go-to-market checklist |
| Private beta guide | Beta process notes |
Install binary → pkgsafe doctor
Scan package → pkgsafe scan-npm-package <name>
pkgsafe scan-pypi-package <name>
Scan project → pkgsafe scan-lockfile ./package-lock.json
pkgsafe scan-python-deps ./requirements.txt
CI gate → GitHub Action or pkgsafe ci scan
AI agent → pkgsafe mcp serve
Tune rules → --policy ./policy.yaml (see policy-guide.md)